...
Your devices need to be able to communicate directly with each other. ZeroTier uses UDP hole punching to do this. It’s a similar process to VoIP STUN/TURN.
The difficulty for strict firewall configurations is: the my.zerotier.com controllers and your devices are on dynamic IP addresses and are listening on random UDP ports.
...
9993
Secondary Port, randomized each start up and after being “offline” for too long.
Random Port for UPnP
...
and NATPMP (UPnP or NATPMP is not required for ZeroTier hole punching to work)
For best results, a device needs be able to send to any IP address, on any UDP port.
If you allow outgoing source:9993 and incoming related return traffic, it’ll probably work OK.
If the NAT type is “symmetric” or “strict” , or “endpoint dependent mapping” (each vendor uses different terminology, ) NAT it will be difficult to make direct connections.
Look for Full Cone NAT, options related to VoIP, persistent NAT, Endpoint Independent Mapping, etc…
Ask your vendor. Let us know what works.
If you are behind a Palo Alto, you will need some kind of ZeroTier bastion. As far as we know, there’s no way to enable endpoint independent mapping. Contact us for help.
Here’s a table of the likeliness of a direct connection between two types of NAT:
NAT type | Hard | Easy | None (WAN) |
|---|---|---|---|
Hard | Very unlikely | Possible | Yes |
Easy | Possible | Yes | Yes |
None (WAN) | Yes | Yes | Yes |
And a network diagram:
...
How do I know if I’m behind a Difficult NAT?
Check zerotier-cli info -j and look at the surfaceAddresses. 
If that list is growing, you may be behind a difficult NAT.
Check zerotier-cli peers and see if connections to peers you care about are “relayed”
See also:
...